ReliaQuest Uncovers DeepLoad Malware for Credential Theft

Cybersecurity researchers at ReliaQuest have uncovered a new malware campaign deploying a loader called DeepLoad, which uses social engineering tactics to infect Windows systems and steal user credentials through advanced evasion methods. The threat first appeared on dark web forums in early February, advertised as a tool for cryptocurrency theft, and has since expanded to target enterprise credentials in recent in-the-wild attacks.

The campaign relies on the ClickFix technique, where victims encounter fake browser error messages prompting them to paste a PowerShell command into the Windows Run dialog to fix a nonexistent issue. Once executed, the command leverages mshta.exe, a legitimate Windows utility, to download and run a heavily obfuscated PowerShell loader. This loader buries its functional code under thousands of lines of meaningless variable assignments, a padding likely generated with artificial intelligence to overwhelm static analysis tools and complicate detection.

DeepLoad employs multiple layers to blend into normal system activity and avoid security monitoring. It disables PowerShell command history and calls underlying Windows functions directly, bypassing...